@@ -10,7 +10,7 @@ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
10
10
if ($openssl_version =~ m / built with OpenSSL (0|1\. 0\. (?:0|1[^\d ]|2[a-d]).*)/ ) {
11
11
plan(skip_all => " too old OpenSSL, need 1.0.2e, was $1 " );
12
12
} else {
13
- plan tests => repeat_each() * (blocks() * 5 + 1) ;
13
+ plan tests => repeat_each() * 38 ;
14
14
}
15
15
16
16
$ENV {TEST_NGINX_HTML_DIR } ||= html_dir();
@@ -61,6 +61,9 @@ ffi.cdef[[
61
61
void ngx_stream_lua_ffi_free_priv_key(void *cdata);
62
62
63
63
int ngx_stream_lua_ffi_ssl_clear_certs(void *r, char **err);
64
+
65
+ int ngx_stream_lua_ffi_ssl_verify_client(void *r, int depth, void *cdata, char **err);
66
+
64
67
]]
65
68
_EOC_
66
69
}
@@ -675,3 +678,162 @@ lua ssl server name: "test.com"
675
678
--- no_error_log
676
679
[error]
677
680
[alert]
681
+
682
+
683
+
684
+ === TEST 6: verify client with CA certificates
685
+ --- stream_config
686
+ server {
687
+ listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
688
+
689
+ ssl_certificate_by_lua_block {
690
+ collectgarbage()
691
+
692
+ local ffi = require "ffi"
693
+ require "defines"
694
+
695
+ local errmsg = ffi.new("char *[1]")
696
+
697
+ local r = require "resty.core.base" .get_request()
698
+ if not r then
699
+ ngx.log(ngx.ERR, "no request found")
700
+ return
701
+ end
702
+
703
+ local f = assert(io.open("t/cert/test.crt", "rb"))
704
+ local cert_data = f:read("*all")
705
+ f:close()
706
+
707
+ local cert = ffi.C.ngx_stream_lua_ffi_parse_pem_cert(cert_data, #cert_data, errmsg)
708
+ if not cert then
709
+ ngx.log(ngx.ERR, "failed to parse PEM cert: ",
710
+ ffi.string(errmsg[0]))
711
+ return
712
+ end
713
+
714
+ local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, 1, cert, errmsg)
715
+ if rc ~= 0 then
716
+ ngx.log(ngx.ERR, "failed to set cdata cert: ",
717
+ ffi.string(errmsg[0]))
718
+ return
719
+ end
720
+ }
721
+
722
+ ssl_certificate ../../cert/test2.crt;
723
+ ssl_certificate_key ../../cert/test2.key;
724
+
725
+ return "$ssl_client_verify\n";
726
+ }
727
+ --- stream_server_config
728
+ lua_ssl_trusted_certificate ../../cert/test.crt;
729
+
730
+ proxy_pass unix:$TEST_NGINX_HTML_DIR/nginx.sock;
731
+ proxy_ssl on;
732
+ proxy_ssl_certificate ../../cert/test.crt;
733
+ proxy_ssl_certificate_key ../../cert/test.key;
734
+
735
+ --- stream_response
736
+ SUCCESS
737
+ --- error_log
738
+
739
+ --- no_error_log
740
+ [error]
741
+ [alert]
742
+
743
+
744
+
745
+ === TEST 7: verify client without CA certificates
746
+ --- stream_config
747
+ server {
748
+ listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
749
+
750
+ ssl_certificate_by_lua_block {
751
+ collectgarbage()
752
+
753
+ local ffi = require "ffi"
754
+ require "defines"
755
+
756
+ local errmsg = ffi.new("char *[1]")
757
+
758
+ local r = require "resty.core.base" .get_request()
759
+ if not r then
760
+ ngx.log(ngx.ERR, "no request found")
761
+ return
762
+ end
763
+
764
+ local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
765
+ if rc ~= 0 then
766
+ ngx.log(ngx.ERR, "failed to set cdata cert: ",
767
+ ffi.string(errmsg[0]))
768
+ return
769
+ end
770
+ }
771
+
772
+ ssl_certificate ../../cert/test2.crt;
773
+ ssl_certificate_key ../../cert/test2.key;
774
+
775
+ return "$ssl_client_verify\n";
776
+ }
777
+ --- stream_server_config
778
+ lua_ssl_trusted_certificate ../../cert/test.crt;
779
+
780
+ proxy_pass unix:$TEST_NGINX_HTML_DIR/nginx.sock;
781
+ proxy_ssl on;
782
+ proxy_ssl_certificate ../../cert/test.crt;
783
+ proxy_ssl_certificate_key ../../cert/test.key;
784
+
785
+ --- stream_response
786
+ FAILED:self signed certificate
787
+ --- error_log
788
+
789
+ --- no_error_log
790
+ [error]
791
+ [alert]
792
+
793
+
794
+
795
+ === TEST 8: verify client but client provides no certificate
796
+ --- stream_config
797
+ server {
798
+ listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
799
+
800
+ ssl_certificate_by_lua_block {
801
+ collectgarbage()
802
+
803
+ local ffi = require "ffi"
804
+ require "defines"
805
+
806
+ local errmsg = ffi.new("char *[1]")
807
+
808
+ local r = require "resty.core.base" .get_request()
809
+ if not r then
810
+ ngx.log(ngx.ERR, "no request found")
811
+ return
812
+ end
813
+
814
+ local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
815
+ if rc ~= 0 then
816
+ ngx.log(ngx.ERR, "failed to set cdata cert: ",
817
+ ffi.string(errmsg[0]))
818
+ return
819
+ end
820
+ }
821
+
822
+ ssl_certificate ../../cert/test2.crt;
823
+ ssl_certificate_key ../../cert/test2.key;
824
+
825
+ return "$ssl_client_verify\n";
826
+ }
827
+ --- stream_server_config
828
+ lua_ssl_trusted_certificate ../../cert/test.crt;
829
+
830
+ proxy_pass unix:$TEST_NGINX_HTML_DIR/nginx.sock;
831
+ proxy_ssl on;
832
+
833
+ --- stream_response
834
+ NONE
835
+ --- error_log
836
+
837
+ --- no_error_log
838
+ [error]
839
+ [alert]
0 commit comments